Failed Certified in Cybersecurity (CC)? Here's Your Recovery Plan

Pro tip: Rescheduling an appointment costs U.S. $50 and cancelling costs U.S. $100. A standard exam purchase must be scheduled and taken within 365 days; a Peace of Mind purchase shortens that window to 180 days for both attempts. Failing candidates receive a proficiency level for each domain at the test centre, which is the only diagnostic ISC2 provides for planning a retake.

• Studying the 2022 domain list because a free course still teaches it
  The outline changes on September 1, 2026, and from that date Business Continuity, Disaster Recovery and Incident Response is no longer a domain. Check that your material covers Security Governance and Identity and Access Management Concepts by name, and that Domain 5 includes threat intelligence and incident response.
• Assuming the free One Million Certified in Cybersecurity course and exam are still available
  ISC2 closed new enrolments on May 20, 2026. Only codes issued before then are still usable, and they must be used to schedule and sit an exam by December 31, 2026. A new candidate pays U.S. $199.
• Planning to flag hard items and return to them
  CC is adaptive and item review is not permitted. Once you finalise an answer, it is locked. Read each item completely the first time, make your decision, and move on, because there is no second pass.
• Panicking because every question feels difficult
  ISC2 states that the algorithm targets items you have roughly a 50 percent chance of answering correctly, so both strong and weak candidates find the later items hard. Difficulty during the exam carries no information about your result.
• Rushing to finish at 100 items
  The exam ends when the algorithm reaches 95 percent confidence, not when you reach a target count. Candidates who pass at exactly 100 items proved proficiency across all domains; going past 100 simply gives the algorithm more evidence. Speed does not help.
• Running out of time before answering 100 items
  If you do not answer 75 operational items and 25 pretest items inside the two hours, ISC2 automatically fails the exam. Breaks count against the two hours. Keep a pace of roughly 70 seconds per item and check the clock every 20 items.
• Treating cloud security as optional because CC is entry level
  Cloud security is a named sub-objective inside Domain 4, which carries 21.3 percent of the exam. The outline asks for cloud characteristics, service models, deployment models, and the shared security model, so learn all four lists rather than one.
• Skimming the ISC2 Code of Ethics
  The Code of Ethics is a named bullet in Domain 1, and you must also confirm you will abide by it to complete the certification application. Learn the four canons and their order, because questions ask which canon applies to a described situation.
• Registering with a name that does not match your ID
  The first and last name on your ID must exactly match your Pearson VUE registration. Names can be updated up to 48 hours before the appointment and cannot be changed at the test centre. A mismatch is recorded as a no-show and forfeits the fee.
• Passing the exam and then doing nothing
  Passing does not make you certified. Submit the certification application at the ISC2 endorsement portal within nine months of the exam pass date, confirm the Code of Ethics, then pay the U.S. $50 annual maintenance fee to start your membership cycle.

• Sitting after 1 Sept 2026 means the new outline
• Learn the five new domain names: Security Principles, Security Governance, IAM Concepts, Networking and Cloud Security, Security Operations and Incident Response
• The exam is adaptive, so answer every item carefully because you cannot go back and change one
• Budget the full 120 minutes for at least 100 items, which is about 70 seconds each
• Memorise the ISC2 Code of Ethics canons in order, since Domain 1 names them explicitly
• Bring two forms of ID and expect a palm vein scan at the Pearson VUE test centre